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What is claimed is: 

1. In a network, a method of processing received e-mail 
messages comprising: 

a) identifying information about a sender of 
a received e-mail message based on data in the message, 
the identified information about the sender including at 
least one of the following: 

i) an actual sender of the message; 

ii) a final IP address used by the 



sender ; 
sender; or 



a final domain name used by the 



iv) an IP path used by the sender; 

b) categorizing whether the received message 
is unsolicited e-mail by using statistics based on 
information about the sender; and 

c) processing the received message based on 
its categorization. 



2. The method of claim 1 wherein the actual sender is 
identified by a signature that includes at least two of 
the following fields from the message header: 

a) an e-mail address used by the sender; 

b) a display name used by the sender; 

c) a domain name used by the sender; 

d) the final IP address used by the sender; 

e) the final domain name used by the sender; 

f) the name of client software used by the 
actual sender; 

g) user -agent; 

h) time zone; 
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i) source IP address; 

j) sendmail version used by a first receiver; 

and 

k) the IP path used to route the message. 



3. The method of claim 1 wherein the actual sender is 
identified by a signature including a range of IP 
addresses and at least one of the following fields from 
the message header: 

a) an e-mail address used by the sender; 

b) a display name used by the sender; 

c) a domain name used by the sender ; 

d) the final IP address used by the sender; 

e) the final domain name used by the sender; 

f) the name of client software used by the 
actual sender; 

g) user -agent; 

h) timezone; 

i) source IP address; 

j) sendmail version used by a first receiver; 



and 



the IP path used to route the message. 



4. The method of claim 1 further comprising using 
statistics compiled at least one database to categorize 
whether the received message is unsolicited e-mail, 
wherein the at least one database includes one of the 
following : 

a) a central database; 

b) at least two centrally -maintained 
databases, each storing and compiling different 
information and statistics; and 

c) a local database. 
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5. The method of claim 4 further comprising using 
statistics compiled at the at least one database to 
compute a score indicating a likelihood that the received 
message is unsolicited e-mail. 

6 . The method of claim 5 wherein the score increases as 

a number of accepted messages having the same inf ormation 
about the sender as the received message increases, the 
information including one of the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 

7 . The method of claim 5 wherein the score decreases as 
a number of rejected messages having the same information 
about the sender as the received message increases, the 
information including one of the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 

8 . The method of claim 5 wherein the score increases as 
a number of unique users in the network accepting 
messages having the same information about the sender as 
the received message increases, the information including 
one of the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 
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9. The method of claim 5 wherein the score decreases as 
a number of unique users in the network rejecting 
messages having the same information about the sender as 
the received message increases, the information including 
one of the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 

10. The method of claim 1 further comprising determining 
the final IP address used by the sender by identifying 
an IP address of a first network device used to send the 
e-mail message to a second network device trusted by a 
recipient of the message. 

11. The method of claim 1 further comprising determining 
the final domain name used by the sender by identifying a 
domain name of an IP address of a first network device 
used to send the e-mail message to a second network 
device trusted by a recipient of the message. 

12. The method of claim 11 further comprising 
determining the final domain name used by the sender by 
removing a predetermined number of subdomains from the 
domain name of the IP address of the first network device 
used to send the e-mail message to the second network 
device trusted by the recipient of the message. 
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13. The method of claim 1 further comprising creating a 
whitelist indicating which messages will be accepted by a 
recipient, the accepted messages identified by at least 
one of the following: 

a) an e-mail address; 

b) an actual sender; 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; and 

g) an IP path. 

14. The method of claim 13 further comprising placing 
the message in the recipient's inbox if the whitelist 
indicates the recipient will accept the message. 



15. The method of claim 1 further comprising creating a 
blacklist which indicates which messages will not be 
accepted by a recipient, the unaccepted messages 
identified by at least one of the following: 

a) an e-mail address; 

b) an actual sender,- 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; 

g) an IP path. 

16. The method of claim 15 further comprising disposing 
of the message if the blacklist indicates the recipient 
will not accept the message, the disposal of the message 
including one of the following: 

a) placing the message in a spam folder; or 

b) deleting the message. 
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17. The method of claim 4 further comprising sending 
information about received messages to the at least one 
database, the information including at least two of the 
following: 

a) information identifying the actual sender; 

b) whether the actual sender is included on a 
recipient's whitelist ; 

c) whether the actual sender is included on 
the recipient's blacklist ; 

d) information identifying the final IP 

address ; 

e) whether the final IP address is included 
on the recipient's whitelist; 

f) whether the final IP address is included 
on the recipient's blacklist; 

g) information identifying the final domain 

name ; 

h) whether the final domain name is included 
on the recipient's whitelist; 

i) whether the final domain name is included 
on the recipient's blacklist; 

j) information identifying the IP path; 

k) whether the IP path is included on the 
recipient's whitelist; 

1) whether the IP path is included on the 
recipient's blacklist; 

m) whether the message could be categorized 

locally; and 

n) whether a recipient changed a 
whitelist/blacklist status of the message. 

18. The method of claim 17 further comprising storing 
information about received messages at the at least one 
database . 
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19. The method of claim 4 further comprising requesting 
the at least one database to send a recipient statistics 
about at least one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; and 

d) an IP path. 



20. The method of claim 4 further comprising sending the 
recipient statistics about at least one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; and 

d) an IP path. 



21. The method of claim 18 further comprising storing 
information about messages sent from an actual sender 
including at least one of the following: 

a) a total number of messages sent; 

b) a number of messages sent over a first 
predetermined time period; 

c) a total number of messages sent to 
recipients in a network who have included the actual 
sender on a whitelist; 

d) a number of messages sent to recipients in 
the network who have included the actual sender on the 
whitelist over a second predetermined time period; 

e) a number of recipients who have included 
the actual sender on the whitelist; 

f) a total number of times a recipient 
changed the actual sender's whitelist/blacklist status; 
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g) a number of times a recipient changed the 
actual sender's whitelist/blacklist status over a third 
predetermined time period; 

h) a total number of messages sent to 
recipients in the network who have not included the 
actual sender on the whitelist; 

i) a number of messages sent to recipients in 
the network who have not included the actual sender on 
the whitelist over a fourth predetermined time period; 

j) a total number of unique recipients in the 
network who have received at least one message from the 
actual sender; 

k) a total number of messages sent to unique 
recipients in a network who have included the actual 
sender on a whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
actual sender on the whitelist. 



22. The method of claim 18 further comprising storing 
information about messages sent from a final IP address 
including at least one of the following: 

a) a total number of messages sent; 

b) a number of messages sent over a first 
predetermined time period; 

c) a total number of messages sent to 
recipients in the network who have included the sender on 
a whitelist; 

d) a number of messages sent to recipients in 
the network who have included the sender on the whitelist 
over a second predetermined time period; 

e) a number of recipients who have 
whitelisted senders having the final IP address who know 
the sender; 
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f) a total number of times a recipient 
changed a whitelist/blacklist status of any sender using 
the final IP address; 

g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the final 
IP address over a third predetermined time period; 

h) a total number of messages sent to 
recipients in the network who have not included the 
sender on the whitelist ; 

i) a number of messages sent to recipients in 
the network who have not included the sender on the 
whitelist over a fourth predetermined time period; 

j) a total number of unique recipients in the 
network who have received at least one message from at 
least one sender using the final IP address; 

k) a total number of messages sent to unique 
recipients in the network who have included the sender on 
the whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
sender on the whitelist. 



23. The method of claim 18 further comprising storing 
information about messages sent from a final domain name 
including at least one of the following: 

a) a total number of messages sent; 

b) a number of messages sent over a first 
predetermined time period; 

c) a total number of messages sent to 
recipients in the network who have included the sender on 
a whitelist; 

d) a number of messages sent to recipients in 
the network who have included the sender on the whitelist 
over a second predetermined time period; 



P6 : PRO- 014 .CLS 



e) a number of recipients who have included 
senders having the final domain name on the whitelist ; 

f) a total number of times a recipient 
changed a whitelist/blacklist status of any sender using 
the final domain name; 

g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the final 
domain name over a third predetermined time period; 

h) a total number of messages sent to 
recipients in the network who have not included the 
sender on the whitelist; 

i) a number of messages sent to recipients in 
the network who have not included the sender on the 
whitelist over a fourth predetermined time period; 

j) a total number of unique recipients in the 
network who have received at least one message from at 
least one sender using the final domain name; 

k) a total number of messages sent to unique 
recipients in the network who have included the sender on 
the whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
sender on the whitelist. 



24. The method of claim 18 further comprising storing 
information about messages sent using an IP path 
including at least one of the following: 

a) a total number of messages sent ; 

b) a number of messages sent over a first 
predetermined time period; 

c) a total number of messages sent to 
recipients in the network who have included the sender 
a whitelist; 
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d) a number of messages sent to recipients in 
the network who have included the sender on the whitelist 
over a second predetermined time period; 

e) a number of recipients who know senders 
using the IP path; 

f) a total number of times a recipient 
changed a whitelist/blacklist status of any sender using 

the IP path; 

g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the IP 
path over a third predetermined time period; 

h) a total number of messages sent to 
recipients in the network who have not included the 
sender on the whitelist; 

i) a number of messages sent to recipients in 
the network who have not included the sender on the 
whitelist in the network over a fourth predetermined time 
period; 

j) a total number of unique recipients in the 
network who have received at least one message from at 
least one sender using the IP path; 

k) a total number of messages sent to unique 
recipients in the network who have included the sender on 
the whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
sender on the whitelist. 



25. The method of claim 4 wherein compiling statistics 
includes at least one of the following: 

a) determining a ratio of a first number 
e-mail messages sent by an actual sender to recipients in 
the network who have included the sender on the whitelist 
in a predetermined time period divided by a second 
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number of e-mail messages sent by an actual sender to 
users in the network in the predetermined time period; 

b) determining a ratio of a first number of 
recipients in the network who have included the sender on 
the whitelist divided by a second number of unique 
recipients in the network who received e -mails from the 
actual sender in a predetermined time period ; 

c) determining a ratio of a first number of 
times in a predetermined time interval a message from the 
actual sender was moved from a whitelist to a blacklist 
divided by a second number of times a message from the 
actual sender was moved from a whitelist to a blacklist; 

d) determining a ratio of a first number of 
times in a predetermined time interval a message from the 
actual sender was moved from a blacklist to a whitelist 
divided by a second number of times a message from the 
actual sender was moved from a blacklist to a whitelist; 

e) determining a ratio of a first number of 
unique users within the network who whitelist ed the 
actual sender within a predetermined time period compared 
to a second number of unique users within the network who 
blacklisted the actual sender within the predetermined 
time period; 

f) determining a ratio reflecting whether the 
actual sender sends a majority .of messages to recipients 
who have included the actual sender on the whitelist; 

g) determining a ratio reflecting a first 
number of wanted messages sent by the actual sender 
compared to a second number of unwanted or total messages 
sent by the actual sender; 

h) determining a difference between a first 
number of expected messages sent by the actual sender and 
a second number of unexpected messages sent by the actual 
sender; 
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i) determining a difference between a first 
number of times a user whitelisted a message from the 
actual sender and a second number of times a user 
blacklisted a message from the actual sender; 

j) determining a difference reflecting 
whether the actual sender sends a majority of messages to 
known recipients; 

k) converting any of the above ratios or 
differences or differences to a score indicating the 
likelihood the message is unsolicited e-mail; and 

1) applying the score to the appropriate 
message in the spam folder. 



26. The method of claim 4 wherein compiling statistics 
includes at least one of the following: 

a) determining a ratio of a first number e- 
mail messages sent by any sender using a final IP address 
to recipients in the network who have included the sender 
on the whitelist in a predetermined time period divided 
by a second number of e-mail messages sent by an any 
sender using the final IP address to users in the network 
in the predetermined time period; 

b) determining a ratio of a first number of 
recipients in the network who have included the sen der on 
the whitelist divided by a second number of unique 
recipients in the network who received e -mails from any 
sender using the final IP address in a predetermined time 
period; 

c) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final IP address was moved from a 
whitelist to a blacklist divided by a second number of 
times a message from any sender using the final IP 
address was moved from a whitelist to a blacklist; 
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d) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final IP address was moved from a 
blacklist to a whitelist divided by a second number of 
times a message from any sender using the final IP 
address was moved from a blacklist to a whitelist; 

e) determining a ratio of a first number of 
unique users within the network who whitelisted any 
sender using the final IP address within a predetermined 
time period compared to a second number of unique users 
within the network who blacklisted any sender using the 
final IP address within the predetermined time period; 

f) determining a ratio reflecting whether any 
sender using the final IP address sends a majority of 
messages to recipients who have included the sender on 
the whitelist; 

g) determining a ratio reflecting a first 
number of wanted messages sent by any sender using the 
final IP address compared to a second number of unwanted 
or total messages sent by any sender using the final IP 
address ; 

h) determining a difference between a first 
number of expected messages sent by any sender using the 
final IP address and a second number of unexpected 
messages sent by any sender using the final IP address; 

i) determining a difference between a first 
number of times a user whitelisted a message from any 
sender using the final IP address and a second number of 
times a user blacklisted a message from any sender using 
the final IP address; 

j) determining a difference reflecting 
whether any sender using the final IP address sends a 
majority of messages to recipients who have included the 
sender on the whitelist; 
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k) converting any of the above ratios or 
differences or differences to a score indicating the 
likelihood the message is unsolicited e-mail; and 

1) applying the score to the appropriate 
message in the spam folder. 

27. The method of claim 4 wherein compiling statistics 
includes at least one of the following: 

a) determining a ratio of a first number 
e-mail messages sent by any sender using a final domain 
name to recipients in the network who have included the 
sender on the whitelist in a predetermined time period 
divided by a second number of e -mail messages sent by 
any sender using the final domain name to users in the 
network in the predetermined time period; 

b) determining a ratio of a first number of 
recipients in the network who have included the sender on 
the whitelist divided by a second number of unique 
recipients in the network who received e -mails from any 
sender using the final domain name in a predetermined 
time period; 

c) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final domain name was moved from a 
whitelist to a blacklist divided by a second number of 
times a message from any sender using the final domain 
name was moved from a whitelist to a blacklist; 

d) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final domain name was moved from a 
blacklist to a whitelist divided by a second number of 
times a message from any sender using the final domain 
name was moved from a blacklist to a whitelist; 
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e) determining a ratio of a first number of 
unique users within the network who whitelisted any 
sender using the final domain name within a predetermined 
time period compared to a second number of unique users 
within the network who blacklisted any sender using the 
final domain name within the predetermined time period; 

f) determining a ratio reflecting whether any 
sender using the final domain name sends a majority of 
messages to recipients who have included the sender on 
the whitelist; 

g) determining a ratio reflecting a first 
number of wanted messages sent by any sender using the 
final domain name compared to a second number of unwanted 
or total messages sent by any sender using the final 
domain name; 

h) determining a difference between a first 
number of expected messages sent by any sender using the 
final domain name and a second number of expected 
messages sent by any sender using the final domain name; 

i) determining a difference between a first 
number of times a user whitelisted a message from any 
sender using the final domain name and a second number of 
times a user blacklisted a message from any sender using 
the final domain name; 

j) determining a difference reflecting 
whether any sender using the final domain name sends a 
majority of messages to recipients who have included the 
sender on the whitelist; 

k) converting any of the above ratios or 
differences or differences to a score indicating the 
likelihood the message is unsolicited e-mail; and 

1) applying the score to the appropriate 
message in the spam folder. 
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28. The method of claim 4 wherein compiling statistics 
includes at least one of the following: 

a) determining a ratio of a first number e- 
mail messages sent by any sender using an IP path to 
recipients in the network who have included the sender on 
the whitelist in a predetermined time period divided by a 
second number of e-mail messages sent by any sender using 
the IP path to users in the network in the predetermined 
time period; 

b) determining a ratio of a first number of 
recipients in the network who have included the sender on 
the whitelist divided by a second number of unique 
recipients in the network who received e -mails from any 
sender using the IP path in a predetermined time period; 

c) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the IP path was moved from a whitelist to a 
blacklist divided by a second number of times a message 
from any sender using the IP path was moved from a 
whitelist to a blacklist; 

d) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the IP path was moved from a blacklist to a 
whitelist divided by a second number of times a message 
from any sender using the IP path was moved from a 
blacklist to a whitelist; 

e) determining a ratio of a first number of 
unique users within the network who whitelisted any 
sender using the IP path within a predetermined time 
period compared to a second number of unique users within 
the network who blacklisted any sender using the IP path 
within the predetermined time period; 

f) determining a ratio reflecting whether any 
sender using the IP path sends a majority of messages to 
recipients who have included the sender on the whitelist; 
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g) determining a ratio reflecting a first 
number of wanted messages sent by any sender using the IP 
path compared to a second number of unwanted or total 
messages sent by any sender using the IP path; 

h) determining a difference between a first 
number of expected messages sent by any sender using the 
IP path and a second number of unexpected messages sent 
by any user using the IP path; 

i) determining a difference between a first 
number of times a user whitelisted a message from any 
sender using the IP path and a second number of times a 
user blacklisted a message from any sender using the IP 
path; 

j) determining a difference reflecting 
whether any sender using the IP path sends a majority of 
messages to recipients who have included the sender on 
the whitelist; 

k) converting any of the above ratios or 
differences or differences to a score indicating the 
likelihood the message is unsolicited e-mail; and 

1) applying the score to the appropriate 
message in the spam folder. 



29. The method of claim 4 further comprising settii 
predetermined threshold for accepting messages base, 
statistics associated with one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; and 

d) an IP path. 
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30. The method of claim 29 further comprising accepting 
messages when information about the message exceeds the 
predetermined threshold. 

31. The method of claim 30 further comprising setting a 
low threshold to differentiate wanted messages from 
unsolicited messages, wherein the low threshold is 
either : 

a) greater than one percent of a number of 
messages sent are accepted, wherein the messages are 
characterized by one of the following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path; 

b) greater than one percent of a number of 
unique users accepting a message wherein the message i s 
characterized by one of the following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path. 

32. The method of claim 4 further comprising revising 
statistics when a recipient changes a whitelist/blackli st 
status of one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 
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33. The method of claim 17 further comprising creating a 
key for storing information about the actual sender. 



34. The method of claim 33 wherein the key is the 
information used to identify the actual sender. 



35. The method of claim 32 wherein a manual reversal 
a whitelist/blacklist status of one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path; 

is more heavily weighted when revising statistics. 



36. The method of claim 1 wherein processing the 
received message includes placing the message in the 
recipient's inbox. 



37. The method of claim 1 wherein processing the 
received message includes placing the message in a spam 
folder. 



38. The method of claim 37 further comprising monitoring 
the spam folder at predetermined intervals to determine 
whether messages should be released. 
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39. The method of claim 38 further comprising 
automatically releasing the message from the spam 
when the reputation of one of the following: 

a) the actual sender; 

b) the final IP address; 

c) the final domain name; or 

d) the IP path; 
passes a predetermined threshold. 



40. The method of claim 37 further comprising 
reevaluating the spam folder immediately before it is 
displayed to a recipient such that information about 
messages in the spam folder is current when viewed by 
recipient . 



41. The method of claim 37 further comprising manually 
transferring the message from the spam folder to the 
recipient's inbox. 



41. The method of claim 20 wherein information about 
least one of the following: 

a) the final IP address; 

b) the final domain name; and 

c) the IP path; 

is sent to the recipient when there is insufficient 
information about the actual sender. 

42. The method of claim 29 further comprising each us 
setting a predetermined personalized spam threshold, 
wherein an incoming message that exceeds the spam 
threshold is sent to a folder designated to hold spam 
messages . 
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43. The method of claim 29 further comprising each user 
setting a predetermined personalized delete threshold, 
wherein an incoming message that exceeds the delete 
threshold is deleted. 



44. The method of claim 4 further comprising maintaining 
at either the central database or the at least two 
centrally-maintained databases at least four of the 
following values: 

a) a number of messages which were explicitly 

ranked good; 

b) a number of messages which were implicitly 

ranked good; 

c) a number of messages whose ranking is 

unknown ; 

d) a number of messages which were explicitly 

ranked bad; and 

e) a number of messages which were implicitly 

ranked bad; 

wherein the values are based on messages hav ing 
the same information about the sender including one of 
the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 



45. The method of claim 44 wherein the values represent 
one of the following: 

a) message counts; or 

b) ratings of unique users within the 

network . 
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46. The method of claim 45 further comprising at least 
four of the values being returned to the recipient to 
allow the recipient to apply different weights to a 
message in order to categorize the message. 

47. The method of claim 4 further comprising evaluating 
an unknown sender based on statistics of one of the 
following: 

a) a known final IP address used by the 

sender; or 

b) a known final domain name used by the 

sender . 

48. The method of claim 4 further comprising evaluating 
an unknown sender using either a known final IP address 
or a known final domain name based on statistics about 
other new senders using either the known final IP address 
or the known final domain. 

49. The method of claim 4 further comprising giving an 
unknown final IP address or final domain name an initial 
good rating. 

50. The method of claim 4 further comprising giving an 
unknown final IP address or domain name an initial rating 
based on the length of time the network has been in 
operation . 
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51. The method of claim 17 further comprising older 
members of the network overwriting a new member's mes 
ratings when the new member's ratings are inconsistei 
when compared to other member's ratings. 



52. The method of claim 5 wherein a final message score 
is determined by one of the following: 

a) an average of two scores for a message; or 

b) a product of two scores for the message ; 
wherein the scores for messages are based on statistics 
associated with a least two of the following: 

a) an actual sender of the message; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 



53. The method of claim 19 wherein personal statistics 
are checked at the local database before global 
statistics at either the central database or the at leai 
two centrally-maintained databases are checked. 



54. The method of claim 17 further comprising rating a 
sender by: 

a) releasing small numbers of the sender's 
messages to recipients; and 

b) monitoring the recipients' classif icatio 
of these messages to determine the sender's rating. 



55. The method of claim 17 further comprising changing 
one user's rating when other members outvote the user's 
rating . 



P6 : PRO- 014 .CLS 



- 64 - 



56. The method of claim 19 wherein either the central 
database or the at least two centrally -maintained 
databases return more than one value to the recipient. 



57. The method of claim 36 further comprising monitoring 
the inbox at predetermined intervals to determine whether 
messages should remain in the inbox. 



58. The method of claim 5 wherein a first score for an 
unknown sender using a known final IP address or final 
domain name may be obtained by multiplying a second score 
for the final IP address or final domain name by a number 
less than one . 



59. The method of claim 13 further comprising creating 
the whitelist by adding the following to the whitelist: 

a) any e-mail addresses stored by a user of 
the e-mail program; 

b) any e-mail address in an outgoing message; 

and 

c) any e-mail address of a sender of a 
message having the same subject line as another message 
previously sent by the user. 



60 



uv . The method of claim 59 further comprising combining 
each e-mail address added to the whitelist with at least 
one other piece of information from the message header 
including : 

a) a display name used by the sender; 

b) a domain name used by the sender; 

c) the final IP address used by the sender ,- 
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d) the final domain name used by the sender; 

e) the name of client software used by the 
actual sender ,- 

f) user - agent; 

g) time zone; 

h) source IP address; 

i) sendmail version used by a first receiver; 

and 

j) the IP path used to route the message. 



61. The method of claim 59 further comprising: 

a) scanning messages received by the user; 

and 

b) determining if a sender of a received 
message is on the whitelist, wherein if the sender is on 
the whitelist: 

i) identifying information about the 
sender of the message based on data in the message, the 
identified information about the sender including at 
least one of the following: 

A) an actual sender of the message; 

B) a final IP address used by the 

sender; 

C) a final domain name used by the 

sender; or 

D) an IP path used by the sender; 

and 

ii) sending the identified information to 
the at least one database. 



62. The method of claim 4 further comprising 
categorizing a received message that cannot be rated 
locally when user activity is observed. 
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63. The method of claim 5 further comprising using a 
second formula to compute the score for the message when 
the message is reevaluated, wherein the second formula 
differs from a first formula used to compute the previous 
message score. 



64. The method of claim 1 further comprising sending 
recipients a notification when any sender's reputatioi 
changes . 



65. The method of claim 64 further comprising reviewing 
all messages received in a predetermined time period 
preceding receipt of the notification and updating the 
categorization of the message as necessary. 



66. A computer -readable storage medium storing 
instructions that, when executed by a computer, cause the 
computer to perform a method of processing a received e - 
mail message, the method performed by the computer 
executing the instruction stored on the medium 
comprising : 

a) identifying information about a sender of 
a received e-mail message based on data in the message, 
the identified information about the sender including at 
least one of the following: 

i) an actual sender of the message; 

ii) a final IP address used by the 



sender ; 
sender; or 



a final domain name used by the 
an IP path used by the sender; 
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b) categorizing whether the received message 
is unsolicited e-mail by using statistics based on 
information about the sender; and 

c) processing the received message based on 
its categorization. 



67. The computer -readable storage medium of claim 66 
wherein the actual sender is identified by a signature 
that includes at least two of the following fields from 
the message header: 

a) an e-mail address used by the sender; 

b) a display name used by the sender; 

c) a domain name used by the sender; 

d) the final IP address used by the sender; 

e) the final domain name used by the sender; 

f) the name of client software used by the 
actual sender; 

g) user -agent; 

h) time zone; 

i) source IP address; 
sendmail version used by a first receiver; 



j) 
k) 



the IP path used to route the message. 



68. The computer -readable storage medium of claim 66 
wherein the actual sender is identified by a signature 
including a range of IP addresses and at least one of the 
following fields from the message header: 

a) an e-mail address used by the sender; 

b) a display name used by the sender; 

c) a domain name used by the sender; 

d) the final IP address used by the sender; 

e) the final domain name used by the sender; 
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f ) 

actual sender; 

g) user-agent 



the name of client software used by the 



j) 
and 



h) timezone; 

i) source IP address; 
sendmail version used by a first receiver; 



the IP path used to route the message. 



69. The computer -readable storage medium of claim 66, 
the method further using statistics compiled at at least 
one database to categorize whether the received message 
is unsolicited e-mail, wherein the at least one database 
includes one of the following: 

a) a central database; 

b) at least two centrally -maintained 
databases, each storing and compiling different 
information and statistics; and 

c) a local database. 



70. The computer -readable storage medium of claim i 
the method further comprising using the statistics 
compiled at at least one database to compute a scon 
indicating the likelihood that the received message 
unsolicited e-mail. 
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71. The computer -readable storage medium of claim 70 
wherein the score increases as a number of accepted 
messages having the same information about the sender as 
the received message increases, the information including 
one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 



72. The computer -readable storage medium of claim 70 
wherein the score decreases as a number of rejected 
messages having the same information about the sender as 
the received message increases, the information including 
one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 



73. The computer -readable storage medium of claim 70 
wherein the score increases as a number of unique users 
in the network accepting messages having the same 
information about the sender as the received message 
increases, the information including one of the 
following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 
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74. The computer -readable storage medium of claim 
wherein the score decreases as a number of unique i 
in the network rejecting messages having the same 
information about the sender as the received messac 
increases, the information including one of the 
following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 



75. The computer -readable storage medium of claim 66, 
the method further comprising determining the final IP 
address used by the sender by identifying an IP address 
of a first network device used to send the e -mail message 
to a second network device trusted by a recipient of the 
message . 



76. The computer -readable storage medium of claim 66, 
the method further comprising determining the final 
domain name used by the sender by identifying a domain 
name of an IP address of a first network device used to 
send the e-mail message to a second network device 
trusted by a recipient of the message. 



77. The computer -readable storage medium of claim 76 
the method further comprising determining the final 
domain name used by the sender by removing a 
predetermined number of subdomains from the domain m 
of the IP address of the first network device used tc 
send the e-mail message to the second network device 
trusted by the recipient of the message. 
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78. The computer -readable storage medium of claim 66, 
the method further comprising creating a whitelist which 
messages will be accepted by a recipient, the accepted 
messages identified by at least one of the following: 

a) an e-mail address; 

b) an actual sender; 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; and 

g) an IP path. 



79. The computer -readable storage medium of claim 71 
the method further comprising placing the message in 
recipient's inbox if the whitelist indicates the 
recipient will accept the message. 



80. The computer -readable storage medium of claim 66, 
the method further comprising creating a blacklist 
indicating which messages will not be accepted by a 
recipient, the unaccepted messages identified by at le 
one of the following: 

a) an e-mail address; 

b) an actual sender; 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; and 

g) an IP path. 
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81. The computer-readable storage medium of claim 80, 
the method further comprising disposing of the message if 
the blacklist indicates the recipient will not accept the 
message, the disposal of the message including one of the 
following: 

a) placing the message in a spam folder; or 

b) deleting the message. 



82. The computer -readable storage medium of claim 69, 
the method further comprising sending information about 
received messages to the central database, the 
information including at least one of the following: 

a) information about the actual sender; 

b) whether the actual sender is included on a 
recipient's whitelist; 

c) whether the actual sender is included on 
the recipient's blacklist; 

d) information about the final IP address; 

e) whether the final IP address is included 
on the recipient's whitelist; 

f) whether the final IP address is included 
on the recipient's blacklist; 

g) information about the final domain name; 

h) whether the final domain name is included 
on the recipient's whitelist; 

i) whether the final domain name is included 
on the recipient's blacklist; 

j) information about the IP path; 

k) whether the IP path is included on the 
recipient's whitelist; 

1) whether the IP path is included on the 
recipient's blacklist; 
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m) whether the message could be categorized 

locally; and 

n) whether a recipient changed a whitelist/ 

blacklist status of the message. 



83. The computer -readable storage medium of claim 69, 
the method further comprising requesting the central 
database to send a recipient statistics about at least 
one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; and 

d) an IP path. 



84. The computer -readable storage medium of claii 
the method further comprising setting a predeterm: 
threshold for accepting messages based on statist: 
associated with one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 



85. The computer-readable storage medium of 84, the 
method further comprising accepting messages when 
information about the message exceeds the predetermined 
threshold. 
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86. The computer -readable storage medium of claim 84, 
the method further comprising setting a lo w threshold to 
differentiate wanted messages from unsolicited messages, 
wherein the low threshold is either: 

a) greater than one percent of a number of 
messages sent are accepted, wherein the messages are 
characterized by one of the following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path; 

b) greater than one percent of a number of 
unique users accepting a message wherein the message is 
characterized by one of the following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path. 



87. The computer -readable storage medium of claim 66, 
wherein processing the received message includes placing 
the message in the recipient's inbox. 



88. The computer -readable storage medium of claim 66, 
wherein processing the received message includes placing 
the message in a spam folder. 



89. The computer -readable storage medium of claim 88, 
the method further comprising manually transferring the 
message from the spam folder to the recipient's inbox. 
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90. The computer -readable storage medium of claim ! 
the method further comprising each user setting a 
predetermined personalized spam threshold, wherein < 
incoming message that exceeds the spam threshold is 
to a folder designated to hold spam messages. 



91. The computer -readable storage medium of claim 84, 
the method further comprising each user setting a 
predetermined personalized delete threshold, wherein an 
incoming message that exceeds the delete threshold is 
deleted . 



92. The computer -readable storage medium of claim 69, 
the method further comprising evaluating an unknown 
sender based on statistics of one of the following: 

a) a known final IP address used by the 

sender; or 

b) a known final domain name used by the 

sender. 



93. The computer -readable storage medium of claim 69, 
the method further comprising evaluating an unknown 
sender using either a known final IP address or a known 
final domain name based on statistics about other new 
senders using either the known final IP address or the 
known final domain. 



94. The computer -readable storage medium of claim 69, 
the method further comprising giving an unknown final 
address or final domain name an initial good rating. 
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95. The computer -readable storage medium of claitr 
the method further comprising giving an unknown f i 
address or domain name an initial rating based on 
length of time the network has been in operation. 



96. The computer -readable storage medium of claim 70, 
wherein a final message score is determined by one of the 
following : 

a) an average of two scores for a message; or 

b) a product of two scores for the message; 
wherein the scores for messages are based on statistics 
associated with a least two of the following: 

a) an actual sender of the message ; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 



97. The computer -readable storage medium of claim 8 
wherein personal statistics are checked at the local 
database before global statistics at either the cent: 
database or the at least two centrally -maintained 
databases are checked. 



98. The computer -readable storage medium of claim 87 
the method further comprising monitoring the inbox at 
predetermined intervals to determine whether messages 
should remain in the inbox. 
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99. The computer -readable storage medium of claim 70, 
wherein a first score for an unknown sender using a knowi 
final IP address or final domain name may be obtained by 
multiplying a second score for the final IP address or 
final domain name by a number less than one. 



100. The computer -readable storage medium of claim 78, 
the method further comprising creating the whitelist by 
adding the following to the whitelist: 

a) any e-mail addresses stored by a user of 
the e-mail program; 

b) any e-mail address in an outgoing message ; 

and 

c) any e-mail address of a sender of a 
message having the same subject line as another message 
previously sent by the user. 



101. The method of claim 100 further comprising 
combining each e-mail address added to the whitelist with 
at least one other piece of information from the message 
header including: 

a) a display name used by the sender; 

b) a domain name used by the sender; 

c) the final IP address used by the sender; 

d) the final domain name used by the sender; 

e) the name of client software used by the 
actual sender; 

f) user - agent; 

g) time zone; 

h) source IP address; 

i) sendmail version used by a first receiver; 

and 

j) the IP path used to route the message. 
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102. The computer -readable storage medium of claim 100, 
the method further comprising: 

a) scanning messages received by the user; 

and 

b) determining if a sender of a received 
message is on the whitelist, wherein if the sender is on 
the whitelist: 

i) identifying information about the 
sender of the message based on data in the message, the 
identified information about the sender including at 
least one of the following: 

A) an actual sender of the message; 

B) a final IP address used by the 

sender; 

C) a final domain name used by the 

sender; or 

D) an IP path used by the sender; 

and 

ii) sending the identified information to 
the at least one database. 



103. The computer -readable s 
the method further comprising 
message that cannot be rated 
is observed. 



torage medium of claim 69, 

categorizing a received 
locally when user activity 



104. The computer -readable storage medium of claim 70, 
the method further comprising using a second formula to 
compute the score for the message when the message is 
reevaluated, wherein the second formula differs from a 
first formula used to compute the previous message score. 
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105. The computer -readable storage medium of claim ■ 
the method further comprising receiving a notificati 
when any sender's reputation changes. 



106. The computer readable s 
the method further comprising 
received in a predetermined t 
of the notification and updat 
the message as necessary. 



torage medium of claim 105, 

reviewing all messages 
ime period preceding receipt 
ing the categorization of 



107. In a computer network, a system for processing 
received e-mail messages comprising: 

a) at least one sending device having a first 
software means to send an e-mail message; 

b) at least one database in network 
connection with the at least one sending device having a 
second software means for compiling information about a 
sender of the e-mail message, wherein the information 
about the sender of an e-mail message is used to 
determine the likelihood that the e-mail message is 
unsolicited e-mail, wherein the information about the 
sender includes at least one of the following: 

i) an actual sender of the message; 

ii) a final IP address used by the 



iii) a final domain name used by the 



sender; 
sender; and 

iv) an IP path used by the sender; 
wherein the at least one database includes one of the 
following: 

i) a central database; 
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ii) at least two centrally -maintained 
databases, each storing and compiling different 
information and statistics; and 

iii) a local database; and 

c) at least one recipient in network 
connection with the at least one sending device and the 
central database, wherein the at least one recipient has 
a third software means for: 

i) receiving the e-mail message from the 

at least one sending device; 

ii) identifying information about the 
sender and sending that information to the at least one 
database; and 

iii) receiving information from the at 
least one database about whether the message is an 
unsolicited e-mail message. 



108. The system of claim 107 wherein the central 
database is located at a network device. 



109. The system of claim 107 wherein the central 
database, the centrally -maintained databases, and the at 
least one recipient are members of an e-mail network. 



110. The system of claim 107 further comprising an 
incoming mail server in network connection with the at 
least one recipient. 



111. The system of claim 110 further comprising an 
outgoing mail server in network connection with the at 
least one sending device and the incoming mail server. 
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112. The system of claim 107 further comprising 
least one recipient having a spam folder. 



113. The system of claim 107 wherein the third software 
means identifies the actual sender by a signature 
including at least two of the following fields from the 
message header: 

a) an e-mail address used by the sender; 

b) a display name used by the sender; 

c) a domain name used by the sender; 

d) the final IP address used by the sender; 

e) the final domain name used by the sender; 

f) the name of client software used by the 
actual sender; 

g) user-agent; 

h) time zone; 

i) source IP address; 

j) sendmail version used by a first receiver; 



and 



the IP path used to route the message. 



114. The system of claim 107 wherein the third software 
means identifies the actual sender by a signature 
including a range of IP addresses and at least one of the 
following fields from the message header: 

a) an e-mail address used by the sender; 

b) a display name used by the sender; 

c) a domain name used by the sender; 

d) the final IP address used by the sender; 

e) the final domain name used by the sender; 

f) the name of client software used by the 
actual sender; 
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j) 
and 



g) user-agent; 

h) timezone; 

i) source IP address; 
sendmail version used by a first receiver; 



the IP path used to route the message. 



115. The system of claim 107 wherein the compiled 
information about the sender of the e -mail message 
includes statistics about the actual sender of the 



message . 



116. The system of claim 107 further comprising either 
the second software means or the third software means 
computing a score based on the compiled information about 
the sender, wherein the score indicates a likelihood that 
the received message is unsolicited e-mail. 



117. The system of claim 116 wherein the score increases 
as a number of accepted messages having the same 
information about the sender as the received message 
increases, the information including one of the 
following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 
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118. The system of claim 116 wherein the score decreases 
as a number of rejected messages having the same 
information about the sender as the received message 
increases, the information including one of the 
following : 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 



119. The system of claim 116 wherein the score increases 
as a number of unique users in the network accepting 
messages having the same information about the sender as 
the received message increases, the information including 
one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 



120. The system of claim 116 wherein the score decreases 
as a number of unique users in the network rejecting 
messages having the same information about the sender as 
the received message increases, the rejected messages 
characterized by one of the following: 

a) an actual sender,- 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 
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121. The system of claim 107 further comprising the 
third software means determining the final IP address 
used by the sender by identifying an IP address of a 
first network device used to send the e -mail message to 
second network device trusted by the recipient receiving 
the message. 



122. The system of claim 107 further comprising the 
third software means determining the final domain name 
used by the sender by identifying a domain name of an 
address of a first network device used to send the e -i 
message to a second network device trusted by the 
recipient receiving the message. 



123. The system of claim 122 further comprising the 
third software means determining the final domain name by 
removing a predetermined number of subdomains from the 
domain name of the IP address of the first network device 
used to send the e-mail message to the second network 
device trusted by the recipient of the message. 

124. The system of claim 107 further comprising the 
third software means creating a whitelist indicating 
which messages will be accepted by a recipient, the 
accepted messages identified by at least one of the 
following : 

a) an e-mail address; 

b) an actual sender; 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; and 

g) an IP path. 
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125. The system of claim 124 further comprising the 
third software means placing the message in the 
recipient's inbox if the whitelist indicates the 
recipient will accept the message. 



126. The system of claim 107 further comprising the 
third software means creating a blacklist indicating 
which indicates which messages will not be accepted by a 
recipient, the unaccepted messages identified by at leas 
one of the following: 

a) an e-mail address; 

b) an actual sender; 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; and 

g) an IP path. 



127. The system of claim 126 further comprising the 
third software means disposing of the message if the 
blacklist indicates the recipient will not accept the 
message, the disposal of the message including one of tl 
following : 

a) placing the message in a spam folder; or 

b) deleting the message. 



128. The system of claim 107 further comprising the 
third software means sending information about received 
messages to the at least one database, the information 
including at least one of the following: 

a) information about the actual sender; 
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b) whether the actual sender is included on a 
recipient's whitelist; 

c) whether the actual sender is included on a 
recipient's blacklist; 

d) information about the final IP address; 

e) whether the final IP address is included 
on the recipient's whitelist; 

f) whether the final IP address is included 
on the recipient's blacklist; 

g) information about the final domain name; 

h) whether the final domain name is included 
on the recipient's whitelist; 

i) whether the final domain name is included 
on the recipient's blacklist; 

j) information about the IP path; 

k) whether the IP path is included on the 
recipient's whitelist; 

1) whether the IP path is included on the 
recipient's blacklist; 

m) whether the message could be categorized 

locally; and 

n) whether a recipient changed a whitelist/ 
blacklist status of the message. 



129 . 



The system of claim 107 further comprising the 
second software means storing information about received 
messages at the at least one database. 
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130. The system of claim 107 further comprising the 
third software means requesting the at least one database 
to send the recipient statistics about at least one of 
the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; and 

d) an IP path. 

131. The system of claim 129 wherein the stored 
information includes at least one of the following about 
messages sent by the actual sender: 

a) a total number of messages sent; 

b) a number of messages sent over a first 
predetermined time period; 

c) a total number of messages sent to 
recipients in the network who have included the actual 
sender on a whitelist; 

d) a number of messages sent to recipients in 
the network who have included the actual sender on the 
whitelist over a second predetermined time period; 

e) a number of recipients who know the actual 

sender; 

f) a total number of times a recipient 
changed an actual sender's whitelist/blacklist status; 

g) a number of times a recipient changed an 
actual sender's whitelist/blacklist status over a third 
predetermined time period; 

h) a total number of messages sent to 
recipients in the network who don't know the actual 
sender; 

i) a number of messages sent to recipients in 
the network who don't know the actual sender over a 
fourth predetermined time period; 
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j) a total number of unique recipients in the 
network who have received at least one message from the 
actual sender; 

k) a total number of messages sent to unique 
recipients in a network who have included the actual 
sender on a whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
actual sender on the whitelist. 



132. The system of claim 129 wherein the stored 
information includes at least one of the following about 
messages sent from a final IP address: 

a) a total number of messages sent; 

b) a number of messages sent over a first 
predetermined time period; 

c) a total number of messages sent to 
recipients in the network who have included a sender on a 
whitelist ; 

d) a number of messages sent to recipients in 
the network who have included the sender on the whitelist 
over a second predetermined time period; 

e) a number of recipients who have 
whitelisted senders having the final IP address; 

f) a total number of times a recipient 
changed a whitelist/blacklist status of any sender using 
the final IP address; 

g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the final 
IP address over a third predetermined time period; 

h) a total number of messages sent to 
recipients in the network who have not included the 
sender on the whitelist; 
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i) a number of messages sent to recipients in 
the network who have not included the sender on the 
whitelist over a fourth predetermined time period; 

j) a total number of unique recipients in the 
network who have received at least one message from at 
least one sender using the final IP address; 

k) a total number of messages sent to unique 
recipients in the network who have included the sender on 
the whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
sender on the whitelist. 



133. The system of claim 129 wherein the stored 
information includes at least one of the following about 
messages sent from a final domain name: 

a) a total number of messages sent; 

b) a number of messages sent over a first 
predetermined time period; 

c) a total number of messages sent to 
recipients in the network who have included a sender on a 
whitelist ; 

d) a number of messages sent to recipients in 
the network who have included the sender on the whitelist 
over a second predetermined time period; 

e) a number of recipients who have 
whitelisted senders using the final domain name; 

f) a total number of times a recipient 
changed a whitelist/blacklist status of any sender using 
the final domain name; 

g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the final 
domain name over a third predetermined time period; 
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h) a total number of messages sent to 
recipients in the network who have not included the 
sender on the whitelist; 

i) a number of messages sent to recipients in 
the network who have not included the sender on the 
whitelist over a fourth predetermined time period; 

j) a total number of unique recipients in the 
network who have received at least one message from at 
least one sender using the final domain name; 

k) a total number of messages sent to unique 
recipients in the network who have included the sender on 
the whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
sender on the whitelist. 



134. The system of claim 129 wherein the stored 
information includes at least one of the following about 
messages sent using an IP path: 

a) a total number of messages sent; 

b) a number of messages sent over a first 
predetermined time period; 

c) a total number of messages sent to 
recipients in the network who have included a sender on a 
whitelist ; 

d) a number of messages sent to recipients in 
the network who have included the sender on the whitelist 
over a second predetermined time period; 

e) a number of recipients who have 
whitelisted senders using the IP path; 

f) a total number of times a recipient 
changed a whit elist/blacklist status of any sender using 
the IP path; 
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g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the IP 
path over a third predetermined time period ; 

h) a total number of messages sent to 
recipients in the network who have not included the 
sender on the whitelist; 

i) a number of messages sent to recipients in 
the network who have not included the sender on the 
whitelist over a fourth predetermined time period; 

j) a total number of unique recipients in the 
network who have received at least one message from at 
least one sender using the IP path; 

k) a total number of messages sent to unique 
recipients in the network who have included the sender on 
the whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
sender on the whitelist. 



135. The system of claim 115 further comprising the 
second software means compiling statistics by doing at 
least one of the following: 

a) determining a ratio of a first number e- 
mail messages sent by an actual sender to recipients in 
the network who have included the sender on the whitelist 
in a predetermined time period divided by a second number 
of e-mail messages sent by an actual sender to users in 
the network in the predetermined time period; 

b) determining a ratio of a first number of 
recipients in the network who have included the sender on 
the whitelist divided by a second number of unique 
recipients in the network who received e -mails from the 
actual sender in a predetermined time period; 
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c) determining a ratio of a first number of 
times in a predetermined time interval a message from the 
actual sender was moved from a whitelist to a blacklist 
divided by a second number of times a message from the 
actual sender was moved from a whitelist to a blacklist; 

d) determining a ratio of a first number of 
times in a predetermined time interval a message from the 
actual sender was moved from a blacklist to a whitelist 
divided by a second number of times a message from the 
actual sender was moved from a blacklist to a whitelist; 

e) determining a ratio of a first number of 
unique users within a network who whitelisted an actual 
sender within a predetermined time period compared to a 
second number of unique users within a network who 
blacklisted the actual sender within the predetermined 

time period; 

f) determining a ratio reflecting whether an 
actual sender sends a majority of messages to known 
recipients ; 

g) determining a ratio reflecting a first 
number of wanted messages sent by the actual sender 
compared to a second number of unwanted or total messages 
sent by the actual sender; 

h) determining a difference between a first 
number of expected messages sent by the actual sender and 
a second number of unexpected messages sent by the actual 
sender; 

i) determining a difference between a first 
number of times a user whitelisted a message from an 
actual sender and a number of times a user blacklisted a 
message from the actual sender; 

j) determining a difference reflecting 
whether the actual sender sends a majority of messages to 
known recipients; and 
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k) converting any of the ratios or 
differences to a score indicating the likelihood the 
message is unsolicited e-mail. 



136. The system of claim 115 further comprising the 
second software means compiling statistics by doing at 
least one of the following: 

a) determining a ratio of a first number e - 
mail messages sent by any sender using a final IP address 
to recipients in the network who have included the se nder 
on the whitelist in a predetermined time period divided 
by a second number of e-mail messages sent by an any 
sender using the final IP address to users in the network 
in the predetermined time period; 

b) determining a ratio of a first number of 
recipients in the network who have included the sender on 
the whitelist divided by a second number of unique 
recipients in the network who received e -mails from any 
sender using the final IP address in a predetermined time 
period; 

c) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final IP address was moved from a 
whitelist to a blacklist divided by a second number of 
times a message from any sender using the final IP 
address was moved from a whitelist to a blacklist; 

d) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final IP address was moved from a 
blacklist to a whitelist divided by a second number of 
times a message from any sender using the final IP 
address was moved from a blacklist to a whitelist; 
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e) determining a ratio of a first number of 
unique users within a network who whitelisted any sender 
using the final IP address within a predetermined time 
period compared to a second number of unique users within 
a network who blacklisted any sender using the final IP 
address within the predetermined time period; 

f) determining a ratio reflecting whether any 
sender using the final IP address sends a majority of 
messages to recipients who have included the sender on 
the whitelist; 

g) determining a ratio reflecting a first 
number of wanted messages sent by any sender using the 
final IP address compared to a second number of unwanted 
or total messages sent by any sender using the final IP 
address ; 

h) determining a difference between a first 
number of expected messages sent by any sender using the 
final IP address and a second number of unexpected 
messages sent by any sender using the final IP address; 

i) determining a difference between a first 
number of times a user whitelisted a message from any 
sender using the final IP address and a second number of 
times a user blacklisted a message from any sender using 
the final IP address; 

j) determining a difference reflecting 
whether any sender using the final IP address sends a 
majority of messages to recipients who have included the 
sender on the whitelist; and 

k) converting any of the above ratios or 
differences to a score indicating the likelihood is 
unsolicited e-mail. 
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137. The system of claim 115 further comprising the 
second software means compiling statistics by doing at 
least one of the following: 

a) determining a ratio of a first number e- 
mail messages sent by any sender using a final domain 
name to recipients in the network who have included the 
sender on the whitelist in a predetermined time period 
divided by a second number of e-mail messages sent by an 
any sender using the final domain name to users in the 
network in the predetermined time period ; 

b) determining a ratio of a first number of 
recipients in the network who have included the sender on 
the whitelist divided by a second number of unique 
recipients in the network who received e -mails from any 
sender using the final domain name in a predetermined 
time period; 

c) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final domain name was moved from a 
whitelist to a blacklist divided by a second number of 
times a message from any sender using the final domain 
name was moved from a whitelist to a blacklist; 

d) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final domain name was moved from a 
blacklist to a whitelist divided by a second number of 
times a message from any sender using the final domain 
name was moved from a blacklist to a whitelist; 

e) determining a ratio of a first number of 
unique users within a network who whitelisted any sender 
using the final domain name within a predetermined time 
period compared to a second number of unique users within 
a network who blacklisted any sender using the final 
domain name within the predetermined time period; 
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f) determining a ratio reflecting whether any 
sender using the final domain name sends a majority of 
messages to recipients who have included the sender on 
the whitelist; 

g) determining a ratio reflecting a first 
number of wanted messages sent by any sender using the 
final domain name compared to a second number of unwanted 
or total messages sent by any sender using the final 
domain name; 

h) determining a difference between a first 
number of expected messages sent by any sender using the 
final domain name and a second number of unexpected 
messages sent by any sender using the final domain name; 

i) determining a difference between a first 
number of times a user whitelisted a message from any 
sender using the final domain name and a second number of 
times a user blacklisted a message from any sender using 
the final domain name; 

j) determining a difference reflecting 
whether any sender using the final domain name sends a 
majority of messages to recipients who have included the 
sender on the whitelist; and 

k) converting any of the above ratios or 
differences to a score indicating the likelihood is 
unsolicited e-mail. 



138. The system of claim 115 further comprising the 
second software means compiling statistics by doing at 
least one of the following: 

a) determining a ratio of a first number e- 
mail messages sent by any sender using an IP path to 
recipients in the network who have included the sender on 
the whitelist in a predetermined time period divided by a 
second number of e-mail messages sent by an any sender 
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using the IP path to users in the network in the 
predetermined time period; 

b) determining a ratio of a first number of 
recipients in the network who have included the sender on 
the whitelist divided by a second number of unique 
recipients in the network who received e -mails from any 
sender using the IP path in a predetermined time period; 

c) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the IP path was moved from a whitelist to a 
blacklist divided by a second number of times a message 
from any sender using the IP path was moved from a 
whitelist to a blacklist; 

d) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the IP path was moved from a blacklist to a 
whitelist divided by a second number of times a message 
from any sender using the IP path was moved from a 
blacklist to a whitelist; 

e) determining a ratio of a first number of 
unique users within a network who whitelisted any sender 
using the IP path within a predetermined time period 
compared to a second number of unique users within a 
network who blacklisted any sender using the IP path 
within the predetermined time period; 

f) determining a ratio reflecting whether any 
sender using the IP path sends a majority of messages to 
recipients who have included the sender on the whitelist; 

g) determining a ratio reflecting a first 
number of wanted messages sent by any sender using the IP 
path compared to a second number of unwanted or total 
messages sent by any sender using the IP path; 
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h) determining a difference between a first 
number of expected messages sent by any sender using the 
IP path and a second number of unexpected messages sent 
by any sender using the IP path; 

i) determining a difference between a first 
number of times a user whitelisted a message from any 
sender using the IP path and a second number of times a 
user blacklisted a message from any sender using the IP 
path; 

j) determining a difference reflecting 
whether any sender using the IP path sends a majority of 
messages to recipients who have included the sender on 
the whitelist; and 

k) converting any of the above ratios or 
differences to a score indicating the likelihood is 
unsolicited e-mail. 



139. The system of claim 116 further comprising the 
second software means applying the score received from 
the at least one database to a message in a spam folder. 

140. The system of claim 107 further comprising the 
third software means setting a predetermined threshold 
for accepting messages based on statistics associated 
with one of the following: 

a) an actual sender; 

b) a final IP address ; 

c) a final domain name; 

d) an IP path. 
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141. The system of claim 140 further comprising the 
third software means accepting messages when informati 
about the message exceeds the predetermined threshold. 



142. The system of claim 140 further comprising the 
third software means setting a low threshold to 
differentiate wanted messages from unsolicited messages, 
wherein the low threshold is either: 

a) greater than one percent of a number of 
messages are accepted, wherein the messages are 
characterized by one of the following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path; 

b) greater than one percent of a number of 
unique users accepting a message wherein the message is 
characterized by one of the following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path. 



143. The system of claim 107 further comprising the 
second software means revising statistics when a 
recipient changes a whitelist/blacklist status of one of 
the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 



P6 : PRO- 014 . CLS 



- 100 - 



144. The system of claim 107 further comprising 
third software means creating a key for storing 
information about the actual sender. 



145. The system of claim 144 wherein the key is the 
information used to identify the actual sender. 



146. The system of claim 107 further comprising 
third software means placing an accepted message 
recipient's inbox. 



147. The system of claim 107 further comprising tl 
third software means placing the message in a spam 
folder. 



148. The system of claim 147 further comprising 
second software means monitoring the spam folder 
predetermined intervals to determine whether mes; 
should be released. 



149. The system of claim 148 further comprising 
second software means automatically releasing th< 
from the spam folder when the reputation of one 
following : 

a) the actual sender; 

b) the final IP address; 

c) the final domain name; or 

d) the IP path; 
passes a predetermined threshold. 
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150. The system of claim 148 further comprising the 
second software means reevaluating the spam folder 
immediately before it is displayed to a user such that 
information about messages in the spam folder is current 
when viewed by the user. 



151. The system of claim 107 wherein the network is the 



Internet . 



152. The system of claim 110 wherein the central 
database is located at the incoming mail server. 



153. The system of claim 107 further comprising the 
second software means sending the recipient informati. 
about at least one of the following: 

a) the actual sender; 

b) the final IP address; 

c) the final domain name; and 

d) the IP path. 



154. The system of claim 153 further comprising the 
second software means sending the recipient information 
about at least one of the following: 

a) the final IP address; 

b) the final domain name; and 

c) the IP path; 

when there is insufficient information about the actual 
sender . 
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155. The system of claim 143 wherein a manual reversal 
of a whitelist/blacklist status is more heavily weighted 
when revising statistics. 



156. The system of claim 107 wherein each of the at 
least two centrally -maintained databases is located at a 
network device. 



157. The system of claim 107 wherein the local database 
is located at the recipient. 



158. The system of claim 140 further comprising the 
third software means setting a predetermined personalized 
spam threshold, wherein an incoming message that exceeds 
the spam threshold is sent to a folder designated to hold 
spam messages . 



159. The system of claim 140 further comprising the 
third software means setting a predetermined personalized 
delete threshold, wherein an incoming message that 
exceeds the delete threshold is deleted. 



160. The system of claim 107 further comprising the 
second software means maintaining at either the central 
database or the at least two centrally -maintained 
databases at least four of the following values: 

a) a number of messages which were explicitly 
ranked good; 

b) a number of messages which were implicitly 
ranked good; 
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c) a number of messages whose ranking is 

unknown ; 

d) a number of messages which were explicitly 
ranked bad; and 

e) a number of messages which were implicitly 

ranked bad; 

wherein the values are based on messages having 
the same information about the sender including one of 
the following: 

i) an actual sender; 

ii) a final IP address used by the 

sender; 

iii) a final domain name used by the 

sender; or 

iv) an IP path used by the sender. 

161. The system of claim 160 wherein the values 
represent one of the following: 

a) message counts; or 

b) ratings of unique users within the 

network . 

162. The system of claim 161 further comprising the 
second software means returning at least four of the 
values to the recipient to allow the recipient to apply 
different weights to a message in order to categorize th 
message . 
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163. The system of claim 107 further comprising the 
second software means evaluating an unknown sender based 
on statistics of one of the following: 

a) a known final IP address used by the 

sender; or 

b) a known final domain name used by the 

sender . 



164. The system of claim 107 further comprising the 
second software means evaluating an unknown sender using 
either a known final IP address or a known final domain 
name based on statistics about other new senders using 
either the known final IP address or the known final 
domain . 



165. The system of claim 107 further comprising the 
second software means giving an unknown final IP address 
or final domain name an initial good rating. 



166. The system of claim 107 further comprising the 
second software means giving an unknown final IP addresi 
or domain name an initial rating based on the length of 
time the network has been in operation. 



167. The system of claim 128 further comprising the 
second software means overwriting new member's message 
ratings when the new member's ratings are inconsistent 
when compared to older network members' ratings. 
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168. The system of claim 116 wherein a final message 
score is determined by one of the following: 

a) an average of two scores for a message; or 

b) a product of two scores for the message; 
wherein the scores for messages are based on 

statistics associated with a least two of the following: 

i) an actual sender of the message ; 

ii) a final IP address used by the 

sender; 

iii) a final domain name used by the 

sender; or 

iv) an IP path used by the sender. 



169. The system of claim 130 wherein personal statistics 
are checked at the local database before global 
statistics at either the central database or the at least 
two centrally-maintained databases are checked. 



170. The system of claim 107 further comprising the 
second software means rating a sender by: 

a) releasing small numbers of a sender's 
messages to recipients; and 

b) monitoring the recipients' classification 
of these messages . 



171. The system of claim 107 further comprising the 
second software means changing one user's rating when 
other members outvote the user's rating. 

172. The system of claim 130 wherein either the cent: 
database or the at least two centrally -maintained 
databases return more than one value to the recipient 



P6 :PRO-014 .CLS 



- 106 - 



173. The system of claim 146 further comprising 
monitoring the inbox at predetermined intervals to 
determine whether messages should remain in the inbox. 



174. The system of claim 116 wherein a first score for 
an unknown sender using a known final IP address or final 
domain name may be obtained by multiplying a second score 
for the final IP address or final domain name by a number 
less than one . 



175. The system of claim 124 further comprising the 
third software means creating the whitelist by adding the 
following to the whitelist: 

a) any e-mail addresses stored by a user of 
the e-mail program; 

b) any e-mail address in an outgoing message; 

and 

c) any e-mail address of a sender of a 
message having the same subject line as another message 
previously sent by the user. 



176. The system of claim 175 further comprising the 
third software means: 

a) scanning messages received by the user; 

and 

b) determining if a sender of a received 
message is on the whitelist, wherein if the sender is 
the whitelist: 

i) identifying information about the 
sender of the message based on data in the message, th 
identified information about the sender including at 
least one of the following: 
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A) an actual sender of the message; 

B) a final IP address used by the 

sender; 

C) a final domain name used by the 

sender; or 

D) an IP path used by the sender; 

and 

ii) sending the identified information to 
the at least one database. 



177. The system of claim 107 further comprising the 
third software means categorizing a received message th 
cannot be rated locally when user activity is observed. 



178. The system of claim 116 further comprising the 
second or third software means using a second formula to 
compute the score for the message when the message is 
reevaluated, wherein the second formula differs from a 
first formula used to compute the previous message score 



179. The system of claim 107 further comprising the 
second software means sending recipients a notificati 
when any sender's reputation changes. 



180. The system of claim 179 further comprising the 
third software means reviewing all messages received in a 
predetermined time period preceding receipt of the 
notification and updating the categorization of the 
message as necessary. 
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181. A method of processing received e-mail messages 
comprising : 

a) identifying information about a sender of 
a received e-mail message based on data in the message, 
the information about the sender including at least one 
of the following: 

i) an actual sender; 

ii) a final IP address used by the 

sender ; 

iii) a final domain name used by the 

sender; and 

iv) an IP path used by the sender; 

b) compiling information about the sender at 
at least one database, wherein the at least one database 
includes one of the following: 

i) a central database; 

ii) at least two centrally -maintained 
databases, each storing and compiling different 
information and statistics; and 

iii) a local database; 

c) using compiled information about the 
sender to categorize whether the received message is 
unsolicited e-mail; and 

d) processing the received message based on 
its categorization. 



182. The method of claim 181 wherein the actual sender i 
identified by a signature including at least two of the 
following fields from the message header: 

a) an e-mail address used by the sender; 

b) a display name used by the sender; 

c) a domain name used by the sender; 

d) the final IP address used by the sender; 

e) the final domain name used by the sender; 
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f ) 

actual sender 



the name of client software used by the 



and 



g) user - agent ; 

h) time zone; 

i) source IP address; 

j) sendmail version used by a first receiver; 

k) the IP path used to route the message. 



183. The method of claim 181 wherein the actual sender 
is identified by a signature including a range of IP 
addresses and at least one of the following fields from 
the message header: 

a) an e-mail address used by the sender ,- 

b) a display name used by the sender; 

c) a domain name used by the sender; 

d) the final IP address used by the sender; 

e) the final domain name used by the sender; 

f) the name of client software used by the 
actual sender ,- 

g) user -agent; 

h) time zone; 

i) source IP address; 

j) sendmail version used by a first receiver; 

and 

k) the IP path used to route the message. 



184. The method of claim 181 further comprising applying 
a score indicating a likelihood that the received message 
is unsolicited e-mail based on the compiled statistics to 
the received message in a spam folder. 
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185. The method of claim 181 wherein the score increases 
as a number of accepted messages having the same 
information about the sender as the received message 
increases, the information including of the following: 

a) an actual sender; 

b) any sender using the final IP address; 

c) any sender using the final domain name; 

d) any sender using a particular IP path. 



186. The method of claim 181 wherein the score decreases 
as a number of rejected messages having the same 
information about the sender as the received message 
increases, the information including one of the 
following : 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; 

d) an IP path used by the sender. 



187. The method of claim 181 wherein the score increases 
as a number of unique users in the network accepting 
messages having the same information about the sender as 
the received message increases, the information including 
one of the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender ; 

d) an IP path used by the sender. 
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188. The method of claim 181 wherein the score decreases 
as a number of unique users in the network rejecting 
messages having the same information about the sender as 
the received message increases, the information including 
one of the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; 

d) an IP path used by the sender. 



189. The method of claim 181 further comprising 
determining the final IP address by identifying an IP 
address of a first network device used to send the e -mai: 
message to a second network device trusted by a recipient 
of the message. 



190. The method of claim 181 further comprising 
determining the final domain name by identifying a domai 
name of an IP address of a first network device used to 
send the e-mail message to a second network device 
trusted by a recipient of the message. 



191. The method of claim 190 further comprising 
determining the final domain name used by the sender by 
removing a predetermined number of subdomains from the 
domain name of the IP address of the first network devi 
used to send the e-mail message to the second network 
device trusted by the recipient of the message. 
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192. The method of claim 181 further comprising creating 
a whitelist indicating which messages will be accepted by 
a recipient, the accepted messages identified by at least 
one of the following: 

a) an e-mail address ,- 

b) an actual sender; 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; and 

g) an IP path. 



193. The method of claim 192 further comprising placing 
the message in the recipient's inbox if the whitelist 
indicates the recipient will accept the message. 

194. The method of claim 181 further comprising creating 
a blacklist which indicates which messages will not be 
accepted by a recipient, the unaccepted messages 
identified by at least one of the following: 

a) an e-mail address; 

b) an actual sender; 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; and 

g) an IP path. 

195. The method of claim 194 further comprising 
disposing of the message if the blacklist indicates the 
recipient will not accept the message, the disposal of 
the message including one of the following: 

a) placing the message in a spam folder; or 

b) deleting the message. 
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196. The method of claim 181 further comprising sending 
information about received messages to the at least one 
database, the information including at least two of the 
following : 

a) information about the actual sender; 

b) whether the actual sender is included on a 
recipient's whitelist; 

c) whether the actual sender is included on 
the recipient's blacklist; 

d) information about the final IP address; 

e) whether the final IP address is included 
on the recipient's whitelist; 

f) whether the final IP address is included 
on the recipient's blacklist; 

g) information about the final domain name; 

h) whether the final domain name is included 
on the recipient's whitelist; 

i) whether the final domain name is included 
on the recipient's blacklist; 

j) information about the IP path; 

k) whether the IP path is included on the 
recipient's whitelist; 

1) whether the IP path is included on the 
recipient's blacklist; 

m) whether the message could be categorized 

locally; and 

n) whether a recipient changed a whitelist/ 
blacklist status of the message. 

197. The method of claim 196 further comprising storing 
information about received messages at the at least one 
database . 
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198. The method of claim 181 further comprising 
requesting the at least one database to send a recipient 
statistics about at least one of the following: 

a) the actual sender; 

b) the final IP address; 

c) the final domain name; and 

d) the IP path. 



199. The method of claim 181 further comprising sending 
the recipient statistics about at least one of the 
following : 

a) the actual sender; 

b) the final IP address; 

c) the final domain name; and 

d) the IP path. 



200. The method of claim 197 further comprising storing 
information about messages sent from an actual sender 
including at least one of the following: 

a) a total number of messages sent; 

b) a number of messages sent over a first 
predetermined time period; 

c) a total number of messages sent to 
recipients in the network who have included the actual 
sender on a whitelist; 

d) a number of messages sent to recipients in 
the network who have included the actual sender on the 
whitelist over a second predetermined time period; 

e) a number of recipients who know the actual 

sender; 

f) a total number of times a recipient 
changed an actual sender's whitelist/blacklist status; 
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g) a number of times a recipient changed an 
actual sender's whitelist/blacklist status over a third 
predetermined time period; 

h) a total number of messages sent to 
recipients in the network who don't know the actual 
sender; 

i) a number of messages sent to recipients in 
the network who don't know the actual sender over a 
fourth predetermined time period; 

j) a total number of unique recipients in the 
network who have received at least one message from the 
actual sender; 

k) a total number of messages sent to unique 
recipients in a network who have included the actual 
sender on a whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
actual sender on the whitelist. 

201. The method of claim 197 further comprising storing 
information about messages sent from a final IP address 
including at least one of the following: 

a) a total number of messages sent; 

b) a number of messages sent over a first 
predetermined time period; 

c) a total number of messages sent to 
recipients in the network who have included a sender on a 
whitelist ; 

d) a number of messages sent to recipients in 
the network who have included the sender on the whitelist 
over a second predetermined time period; 

e) a number of recipients who have 
whitelisted senders having the final IP address; 



P6:PRO-014.CLS 



- 116 - 



f) a total number of times a recipient 
changed a whitelist/blacklist status of any sender usi ng 
the final IP address; 

g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the final 
IP address over a third predetermined time period; 

h) a total number of messages sent to 
recipients in the network who have not included the 
sender on the whitelist; 

i) a number of messages sent to recipients in 
the network who have not included the sender on the 
whitelist over a fourth predetermined time period; 

j) a total number of unique recipients in the 
network who have received at least one message from at 
least one sender using the final IP address; 

k) a total number of messages sent to unique 
recipients in the network who have included the sender on 
the whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
sender on the whitelist. 



202. The method of claim 197 further comprising storing 
information about messages sent from a final domain name 
including at least one of the following: 

a) a total number of messages sent; 

b) a number of messages sent over a first 
predetermined time period; 

c) a total number of messages sent to 
recipients in the network who have included a sender on 
whitelist ; 
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d) a number of messages sent to recipients in 
the network who have included the sender on the whitelist 
over a second predetermined time period; 

e) a number of recipients who have 
whitelisted senders using the final domain name; 

f) a total number of times a recipient 
changed a whitelist/blacklist status of any sender using 
the final domain name; 

g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the final 
domain name over a third predetermined time period; 

h) a total number of messages sent to 
recipients in the network who have not included the 
sender on the whitelist; 

i) a number of messages sent to recipients in 
the network who have not included the sender on the 
whitelist over a fourth predetermined time period; 

j) a total number of unique recipients in the 
network who have received at least one message from at 
least one sender using the final domain name; 

k) a total number of messages sent to unique 
recipients in the network who have included the sender on 
the whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
sender on the whitelist. 



203. The method of claim 197 further comprising storing 
information about messages sent using an IP path 
including at least one of the following: 

a) a total number of messages sent; 

b) a number of messages sent over a first 
predetermined time period; 
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c) a total number of messages sent to 
recipients in the network who have included a sender on a 
whitelist ; 

d) a number of messages sent to recipients in 
the network who have included the sender on the whitelist 
over a second predetermined time period; 

e) a number of recipients who have 
whitelisted senders using the IP path; 

f) a total number of times a recipient 
changed a whitelist/blacklist status of any sender using 
the IP path; 

g) a number of times a recipient changed the 
whitelist/blacklist status of any sender using the IP 
path over a third predetermined time period; 

h) a total number of messages sent to 
recipients in the network who have not included the 
sender on the whitelist; 

i) a number of messages sent to recipients in 
the network who have not included the sender on the 
whitelist over a fourth predetermined time period; 

j) a total number of unique recipients in the 
network who have received at least one message from at 
least one sender using the IP path; 

k) a total number of messages sent to unique 
recipients in the network who have included the sender on 
the whitelist; and 

1) a total number of messages sent to unique 
recipients in the network who have not included the 
sender on the whitelist. 
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204. The method of claim 181 wherein compiling 
statistics includes at least one of the following: 

a) determining a ratio of a first number e- 
mail messages sent by an actual sender to recipient s who 
know the actual sender in a predetermined time period 
divided by a second number of e-mail messages sent by an 
actual sender to users in the network in the 
predetermined time period; 

b) determining a ratio of a first number of 
recipients who know the actual sender divided by a second 
number of unique recipients in the network who received 
e-mails from the actual sender in a predetermined time 
period; 

c) determining a ratio of a first number of 
times in a predetermined time interval a message from the 
actual sender was moved from a whitelist to a blacklist 
divided by a second number of times a message from the 
actual sender was moved from a whitelist to a blacklist; 

d) determining a ratio of a first number of 
times in a predetermined time interval a message from the 
actual sender was moved from a blacklist to a whitelist 
divided by a second number of times a message from the 
actual sender was moved from a blacklist to a whitelist; 

e) determining a ratio of a first number of 
unique users within a network who whitelisted an actual 
sender within a predetermined time period compared to a 
second number of unique users within the network who 
blacklisted the actual sender within the predetermined 
time period; 

f) determining a ratio reflecting whether an 
actual sender sends a majority of messages to known 
recipients ; 
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g) determining a ratio reflecting a first 
number of wanted messages sent by the actual sender 
compared to a second number of unwanted or total messages 
sent by the actual sender; 

h) determining a difference between a first 
number of expected messages sent by the actual sender and 
a second number of unexpected messages sent by the actual 
sender; 

i) determining a difference between a first 
number of times a user whitelisted a message from the 
actual sender and a second number of times a user 
blacklisted a message from the actual sender; 

j) determining a difference reflecting 
whether the actual sender sends a majority of messages to 
recipients who know the actual sender; and 

k) converting any of the above ratios or 
differences to a score indicating the likelihood the 
message is unsolicited e-mail. 



205. The method of claim 181 wherein compiling 
statistics includes at least one of the following: 

a) determining a ratio of a first number e- 
mail messages sent by any sender using a final IP address 
to recipients in the network who have included the sender 
on the whitelist in a predetermined time period divided 
by a second number of e-mail messages sent by an any 
sender using the final IP address to users in the network 
in the predetermined time period; 

b) determining a ratio of a first number of 
recipients in the network who have included the sender on 
the whitelist divided by a second number of unique 
recipients in the network who received e-mails from any 
sender using the final IP address in a predetermined time 
period; 
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c) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final IP address was moved from a 
whitelist to a blacklist divided by a second number of 
times a message from any sender using the final IP 
address was moved from a whitelist to a blacklist; 

d) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final IP address was moved from a 
blacklist to a whitelist divided by a second number of 
times a message from any sender using the final IP 
address was moved from a blacklist to a whitelist; 

e) determining a ratio of a first number of 
unique users within a network who whitelisted any sender 
using the final IP address within a predetermined time 
period compared to a second number of unique users within 
the network who blacklisted any sender using the final IP 
address within the predetermined time period; 

f) determining a ratio reflecting whether any 
sender using the final IP address sends a majority of 
messages to recipients who have included the sender on 
the whitelist; 

g) determining a ratio reflecting a first 
number of wanted messages sent by any sender using the 
final IP address compared to a second number of unwanted 
or total messages sent by any sender using the final IP 
address ; 

h) determining a difference between a first 
number of expected messages sent by any sender using the 
final IP address and a second number of unexpected 
messages sent by any sender using the final IP address; 
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i) determining a difference between a first 
number of times a user whitelisted a message from any 
sender using the final IP address and a second number o f 
times a user blacklisted a message from any sender using 
the final IP address; 

j) determining a difference reflecting 
whether any sender using the final IP address sends a 
majority of messages to recipients who have included the 
sender on the whitelist ; and 

k) converting any of the above ratios or 
differences to a score indicating the likelihood the 
message is unsolicited e-mail. 



206. The method of claim 181 wherein compiling 
statistics includes at least one of the following: 

a) determining a ratio of a first number 
e-mail messages sent by any sender using a final domain 
name to recipients in the network who have included the 
sender on the whitelist in a predetermined time period 
divided by a second number of e -mail messages sent by an 
any sender using the final domain name to users in the 
network in the predetermined time period ,- 

b) determining a ratio of a first number of 
recipients in the network who have included the sender on 
the whitelist divided by a second number of unique 
recipients in the network who received e-mails from any 
sender using the final domain name in a predetermined 
time period; 

c) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final domain name was moved from a 
whitelist to a blacklist divided by a second number of 
times a message from any sender using the final domain 
name was moved from a whitelist to a blacklist; 



P6:PRO-014.CLS 



- 123 - 



d) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the final domain name was moved from a 
blacklist to a whitelist divided by a second number of 
times a message from any sender using the final domain 
name was moved from a blacklist to a whitelist; 

e) determining a ratio of a first number of 
unique users within a network who whitelisted any sender 
using the final domain name within a predetermined time 
period compared to a second number of unique users within 
the network who blacklisted any sender using the final 
domain name within the predetermined time period; 

f) determining a ratio reflecting whether any 
sender using the final domain name sends a majority of 
messages to recipients who have included the sender on 
the whitelist; 

g) determining a ratio reflecting a first 
number of wanted messages sent by any sender using the 
final domain name compared to a second number of unwanted 
or total messages sent by any sender using the final 
domain name; 

h) determining a difference between a first 
number of expected messages sent by any sender using the 
final domain name and a second number of unexpected 
messages sent by any sender using the final domain name; 

i) determining a difference between a first 
number of times a user whitelisted a message from any 
sender using the final domain name and a second number of 
times a user blacklisted a message from any sender using 
the final domain name; 

j) determining a difference reflecting 
whether any sender using the final domain name sends a 
majority of messages to recipients who have included the 
sender on the whitelist; and 
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k) converting any of the above ratios or 
differences to a score indicating the likelihood the 
message is unsolicited e-mail. 



207. The method of claim 181 wherein compiling 
statistics includes at least one of the following: 

a) determining a ratio of a first number 
e-mail messages sent by any sender using an IP path to 
recipients in the network who have included the sender on 
the whitelist in a predetermined time period divided by a 
second number of e-mail messages sent by an any sender 
using the IP path to users in the network in the 
predetermined time period; 

b) determining a ratio of a first number of 
recipients in the network who have included the sender on 
the whitelist divided by a second number of unique 
recipients in the network who received e -mails from any 
sender using the IP path in a predetermined time period; 

c) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the IP path was moved from a whitelist to a 
blacklist divided by a second number of times a message 
from any sender using the IP path was moved from a 
whitelist to a blacklist; 

d) determining a ratio of a first number of 
times in a predetermined time interval a message from any 
sender using the IP path was moved from a blacklist to a 
whitelist divided by a second number of times a message 
from any sender using the IP path was moved from a 
blacklist to a whitelist; 

e) determining a ratio of a first number of 
unique users within the network who whitelisted any 
sender using the IP path within a predetermined time 
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period compared to a second number of unique users within 
the network who blacklisted any sender using the IP path 
within the predetermined time period; 

f) determining a ratio reflecting whether any 
sender using the IP path sends a majority of messages to 
recipients who have included the sender on the whitelist; 

g) determining a ratio reflecting a first 
number of wanted messages sent by any sender using the IP 
path compared to a second number of unwanted or total 
messages sent by any sender using the IP path; 

h) determining a difference between a first 
number of expected messages sent by any sender using the 
IP path and a second number of unexpected messages sent 
by any sender using the IP path; 

i) determining a difference between a first 
number of times a user whitelisted a message from any 
sender using the IP path and a second number of times a 
user blacklisted a message from any sender using the IP 
path; 

j) determining a difference reflecting 
whether any sender using the IP path sends a majority of 
messages to recipients who have included the sender on 
the whitelist; and 

k) converting any of the above ratios or 
differences to a score indicating the likelihood the 
message is unsolicited e-mail. 



208. The method of claim 181 further comprising setting 
a predetermined threshold for accepting messages based oi 
statistics associated with one of the following: 

a) an actual sender; 

b) a final IP address ; 

c) a final domain name; 
d) an IP path. 
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209. The method of claim 208 further comprising 
accepting messages when information about the message 
exceeds the predetermined threshold. 



210. The method of claim 209 further comprising setting 
a low threshold to differentiate wanted messages from 
unsolicited messages, wherein the low threshold is 
either: 

a) greater than one percent of a number of 
messages sent are accepted, wherein the messages are 
characterized by one of the following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path; 

b) greater than one percent of a number of 
unique users accepting a message wherein the message is 
characterized by one of the following: 

i) an actual sender; 

ii) a final IP address ; 

iii) a final domain name; or 

iv) an IP path. 



211. The method of claim 181 further comprising revising 
statistics when a recipient changes a whitelist/blacklist 
status of one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; 

d) an IP path. 
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212. The method of claim 196 further comprising creating 
a key for storing information about the actual sender. 

213. The method of claim 212 wherein the key is the 
information used to identify the actual sender. 

214. The method of claim 211 wherein a manual reversal 
of a whitelist/blacklist status is more heavily weighted 
when computing statistics. 

215. The method of claim 181 wherein processing the 
received message includes placing the message in t he 
recipient's inbox. 

216. The method of claim 181 wherein processing the 
received message includes placing the message in a spam 
folder. 

217. The method of claim 216 further comprising 
monitoring the spam folder at predetermined intervals to 
determine whether messages should be released. 

218. The method of claim 217 further comprising 
automatically releasing the message from the spam folder 
when the reputation of one of the following: 

a) the actual sender; 

b) the final IP address; 

c) the final domain name; or 

d) the IP path; 
passes a predetermined threshold. 
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219. The method of claim 216 further comprising 
reevaluating the spam folder immediately before it is 
displayed to a recipient such that information about 
messages in the spam folder is current when viewed by the 
recipient . 

220. The method of claim 216 further comprising manually 
transferring the message from the spam folder to the 
recipient's inbox. 

221. The method of claim 208 further comprising each 
user setting a predetermined personalized spam threshold, 
wherein an incoming message that exceeds the spam 
threshold is sent to a folder designated to hold spam 
messages . 

222. The method of claim 208 further comprising each 
user setting a predetermined personalized delete 
threshold, wherein an incoming message that exceeds the 
delete threshold is deleted. 

223. The method of claim 181 further comprising 
maintaining at either the central database or the at 
least two centrally -maintained databases at least four of 
the following values: 

a) a number of messages which were explicitly 
ranked good; 

b) a number of messages which were implicitly 
ranked good; 

c) a number of messages whose ranking is 

unknown ; 
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d) a number of messages which were explicitly 
ranked bad; and 

e) a number of messages which were implicitly 

ranked bad; 

wherein the values are based on messages having 
the same information about the sender including one of 
the following: 

i) an actual sender; 

ii) a final IP address used by the 

sender; 

iii) a final domain name used by the 

sender; or 

iv) an IP path used by the sender. 

224. The method of claim 223 wherein the values 
represent one of the following: 

a) message counts; or 

b) ratings of unique users within the 

network . 

225. The method of claim 224 further comprising at least 
four of the values being returned to the recipient to 
allow the recipient to apply different weights to a 
message in order to categorize the message. 

226. The method of claim 181 further comprising 
evaluating an unknown sender based on statistics of one 
of the following: 

a) a known final IP address used by the 

sender; or 

b) a known final domain name used by the 

sender . 
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227. The method of claim 181 further comprising 
evaluating an unknown sender using either a known final 
IP address or a known final domain name based on 
statistics about other new senders using either the known 
final IP address or the known final domain. 

228. The method of claim 181 further comprising giving 
an unknown final IP address or final domain name an 
initial good rating. 

229. The method of claim 181 further comprising giving 
an unknown final IP address or domain name an initial 
rating based on the length of time the network has been 
in operation. 

230. The method of claim 196 further comprising older 
members of the network overwriting a new member's message 
ratings when the new member's ratings are inconsistent 
when compared to other member's ratings. 

231. The method of claim 184 wherein a final message 
score is determined by one of the following: 

a) an average of two scores for a message; or 

b) a product of two scores for the message ; 
wherein the scores for messages are based on statistics 
associated with a least two of the following: 

i) an actual sender of the message; 

ii) a final IP address used by the 

sender; 

iii) a final domain name used by the 

sender; or 

iv) an IP path used by the sender. 
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232. The method of claim 198 wherein personal statistics 
are checked at the local database before global 
statistics at either the central database or the at least 
two centrally-maintained databases are checked. 

233. The method of claim 196 further comprising rating a 
sender by: 

a) releasing small numbers a sender's 
messages to recipients; and 

b) monitoring the recipients' classification 
of these messages. 

234. The method of claim 196 further comprising changing 
one user's rating when other members outvote the user's 
rating . 

235. The method of claim 198 wherein either the central 
database or the at least two centrally -maintained 
databases return more than one value to the recipient. 

236. The method of claim 215 further comprising 
monitoring the inbox at predetermined intervals to 
determine whether messages should remain in the inbox. 

237. The method of claim 184 wherein a first score for 
an unknown sender using a known final IP address or final 
domain name may be obtained by multiplying a second score 
for the final IP address or final domain name by a number 
less than one . 
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238. The method of claim 192 further comprising creating 
the whitelist by adding the following to the whitelist : 

a) any e-mail addresses stored by a user of 
the e-mail program; 

b) any e-mail address in an outgoing message; 

and 

c) any e-mail address of a sender of a 
message having the same subject line as another message 
previously sent by the user. 



239. The method of claim 238 further comprising combining 
each e-mail address added to the whitelist with at least 
one other piece of information from the message header 
including : 

a) a display name used by the sender; 

b) a domain name used by the sender ,- 

c) the final IP address used by the sender; 

d) the final domain name used by the sender; 

e) the name of client software used by the 



actual sender; 

f) 

g) 

h) 
i) 



user -agent ; 
time zone ; 

source IP address; 

sendmail version used by a first receiver; 



the IP path used to route the message. 



240. The method of claim 238 further comprising: 

a) scanning messages received by the user; 

and 

b) determining if a sender of a received 
message is on the whitelist, wherein if the sender is on 
the whitelist: 
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i) identifying information about the 
sender of the message based on data in the message, the 
identified information about the sender including at 
least one of the following: 

A) an actual sender of the message; 

B) a final IP address used by the 



sender; 
sender; or 
and 



C) a final domain name used by the 

D) an IP path used by the sender; 



ii) sending the identified information to 
the at least one database. 



241. The method of claim 181 further comprising 
categorizing a received message that cannot be rated 
locally when user activity is observed. 



242. The method of claim 184 further comprising using a 
second formula to compute the score for the message when 
the message is reevaluated, wherein the second formula 
differs from a first formula used to compute the previous 
message score. 



243. The method of claim 181 further comprising sending 
recipients a notification when any sender's reputation 
changes . 

244. The method of claim 243 further comprising 
reviewing all messages received in a predetermined time 
period preceding receipt of the notification and updating 
the categorization of the message as necessary. 
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